CVE-2021-1675 Print Spooler Exploitation IPC Access

Status: test
Severity: critical
Log source: product windows, service security
Author: INIT_6
Source: github.com/SigmaHQ/sigma

Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1569` System Services

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 5145: A network share object was checked to see whether client can be granted desired access.

Rule body

title: CVE-2021-1675 Print Spooler Exploitation IPC Access
id: 8fe1c584-ee61-444b-be21-e9054b229694
status: test
description: Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527
references:
    - https://twitter.com/INIT_3/status/1410662463641731075
author: INIT_6
date: 2021-07-02
modified: 2022-10-05
tags:
    - attack.execution
    - attack.t1569
    - cve.2021-1675
    - cve.2021-34527
    - detection.emerging-threats
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5145
        ShareName: '\\\\\*\\IPC$' # looking for the string \\*\IPC$
        RelativeTargetName: 'spoolss'
        AccessMask: '0x3'
        ObjectType: 'File'
    condition: selection
falsepositives:
    - Unknown
level: critical

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    EventID: 5145
    ShareName: '\\\\\*\\IPC$'
    RelativeTargetName: 'spoolss'
    AccessMask: '0x3'
    ObjectType: 'File'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AccessMask`	eq	`0x3`	`field:"AccessMask" kind:eq value:"0x3"`
`ObjectType`	eq	`File` corpus 10 (sigma 8, splunk 2)	`field:"ObjectType" kind:eq value:"File"`
`RelativeTargetName`	eq	`spoolss` corpus 3 (sigma 3)	`field:"RelativeTargetName" kind:eq value:"spoolss"`
`ShareName`	eq	`\\\\\*\\IPC$` corpus 7 (sigma 7)	`field:"ShareName" kind:eq value:"\\\\\*\\IPC$"`